Booktics Appointment Booking Calendar For Service Businesses
Monthly
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.